Fortinet FCSS_EFW_AD-7.6 Exam Questions Simulate Actual FCSS_EFW_AD-7.6 Exam

FCSS_EFW_AD-7.6 exam dumps questions are designed to simulate the actual exam. This means that you will get a feel for the types of questions you can expect to see on the exam, as well as the format and difficulty level. In addition, FCSS In Network Security FCSS_EFW_AD-7.6 dumps are often accompanied by detailed explanations and answers. This means that if you get a question wrong, you can learn from your mistake and understand why the correct answer is the right one. Test free online FCSS_EFW_AD-7.6 exam dumps below.

Page 1 of 2

1. An administrator received a FortiAnalyzer alert that a 1 ТВ disk filled up in a day. Upon investigation, they found thousands of unusual DNS log requests, such as JHCMQK.website.com, with no answers. They later discovered that DNS exfiltration was occurring through both UDP and TLS.

How can the administrator prevent this data theft technique?

Create an inline-CASB to protect against DNS exfiltration.

Configure a File Filter profile to prevent DNS exfiltration.

Enable DNS Filter to protect against DNS exfiltration.

Use an IPS profile and DNS exfiltration-related signatures.

 Loading...

2. Refer to the exhibit, which shows an ADVPN network





An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.

What two options must the administrator configure in BGP? (Choose two.)

set ebgp-enforce-multrhop enable

set next-hop-self enable

set ibgp-enforce-multihop advpn

set attribute-unchanged next-hop

 Loading...

3. Refer to the exhibit.

A pre-run CLI template that is used in zero-touch provisioning (ZTP) and low-touch provisioning (LTP) with FortiManager is shown.





The template is not assigned even though the configuration has already been installed on FortiGate.

What is true about this scenario?

The administrator did not assign the template correctly when adding the model device because pre-CLI templates remain permanently assigned to the firewall

Pre-run CLI templates are automatically unassigned after their initial installation

Pre-run CLI templates for ZTP and LTP must be unassigned manually after the first installation to avoid conflicting error objects when importing a policy package

The administrator must use post-run CLI templates that are designed for ZTP and LTP

 Loading...

4. Refer to the exhibit, which shows a partial enterprise network.





An administrator would like the area 0.0.0.0 to detect the external network.

What must the administrator configure?

Enable RIP redistribution on FortiGate

Configure a distribute-route-map-in on FortiGate

Configure a virtual link between FortiGate A and

Set the area 0.0.0.l type to stub on FortiGate A and

 Loading...

5. An administrator wants to scale the IBGP sessions and optimize the routing table in an IBGP network.

Which parameter should the administrator configure?

network-import-check

ibgp-enforce-multihop

neighbor-group

route-reflector-client

 Loading...

6. Refer to the exhibit, which shows a LAN interface connected from FortiGate to two FortiSwitch devices.





What two conclusions can you draw from the corresponding LAN interface? (Choose two.)

You must enable STP or RSTP on FortiGate and FortiSwitch to avoid layer 2 loopbacks.

The LAN interface must use a 802.3ad type interface.

This connection is using a FortiLInk to manage VLANs on FortiGate.

FortiGate is using an SD-WAN-type interface to connect to a FortiSwitch device with MCLA

 Loading...

7. Refer to the exhibit, which shows a network diagram showing the addition of site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and site 1.





Which IPsec phase 2 configuration must an administrator make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?

Set route-overlap to either use-new or use-old

Set net-device to ecmp

Set single-source to enable

Set route-overlap to allow

 Loading...

8. 1.A company that acquired multiple branches across different countries needs to install new FortiGate devices on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial configuration on the FortiGate devices.

Which three approaches can the company take to successfully deploy advanced initial configurations on remote branches? (Choose three.)

Use metadata variables to dynamically assign values according to each FortiGate device.

Use provisioning templates and install configuration settings at the device layer.

Use the Global ADOM to deploy global object configurations to each FortiGate device.

Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.

Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices.

 Loading...

9. Refer to the exhibit, which shows an enterprise network connected to an internet service provider.





An administrator must configure a loopback as a BGP source to connect to the ISP.

Which two commands are required to establish the connection? (Choose two.)

ebgp-enforce-multihop

update-source

ibgp-enforce-multihop

recursive-next-hop

 Loading...

10. Refer to the exhibit, which shows a command output.





FortiGate_A and FortiGate_B are members of an FGSP cluster in an enterprise network.

While testing the cluster using the ping command, the administrator monitors packet loss and found that the session output on FortiGate_B is as shown in the exhibit.

What could be the cause of this output on FortiGate_B?

The session synchronization is encrypted.

session-pickup-connectionless is set to disable on FortiGate_

FortiGate_B is configured in passive mode.

FortiGate_A and FortiGate_B have the same standalone-group-id value.

 Loading...

Page 2 of 2

11. Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud.





What two conclusions can you draw from the exhibit? (Choose two.)

FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.

FortiGate is connecting to the same IP server and will receive an independent certificate for its connection between FortiGate and FortiManager Cloud.

If the TLS handshake contains 17 cipher suites it means the TLS version must be 1.0 on this three-way handshake.

The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.

 Loading...

12. Refer to the exhibit, which shows an ADVPN network.





The client behind Spoke-1 generates traffic to the device located behind Spoke-2.

What is the first message that the hub sends to Spoke-1 to bring up the dynamic tunnel?

Shortcut query

Shortcut offer

Shortcut reply

Shortcut forward

 Loading...

13. Refer to the exhibit.





The routing tables of FortiGate_A and FortiGate_B are shown. FortiGate_A and FortiGate_B are in the same autonomous system.

The administrator wants to dynamically add only route 172.16.1.248/30 on FortiGate_A.

What must the administrator configure?

The prefix 172.16.1.248/30 in the BGP Networks section on FortiGate_B

A BGP route map out for 172.16.1.248/30 on FortiGate_B

Enable Redistribute Connected in the BGP section on FortiGate_

A BGP route map in for 172.16.1.248/30 on FortiGate_A

 Loading...

14. An administrator is setting up an ADVPN configuration and wants to ensure that peer IDs are not exposed during VPN establishment.

Which protocol can the administrator use to enhance security?

Use IKEv2, which encrypts peer IDs and prevents exposure.

Opt for SSL VPN web mode because it does not use peer IDs at all.

Choose IKEv1 aggressive mode because it simplifies peer identification.

Stick with IKEv1 main mode because it offers better performance.

 Loading...

15. A user reports that their computer was infected with malware after accessing a secured HTTPS website. However, when the administrator checks the FortiGate logs, they do not see that the website was detected as insecure despite having an SSL certificate and correct profiles applied on the policy.

How can an administrator ensure that FortiGate can analyze encrypted HTTPS traffic on a website?

The administrator must enable reputable websites to allow only SSL/TLS websites rated by FortiGuard web filter.

The administrator must enable URL extraction from SNI on the SSL certificate inspection to ensure the TLS three-way handshake is correctly analyzed by FortiGate.

The administrator must enable DNS over TLS to protect against fake Server Name Indication (SNI) that cannot be analyzed in common DNS requests on HTTPS websites.

The administrator must enable full SSL inspection in the SSL/SSH Inspection Profile to decrypt packets and ensure they are analyzed as expected.

 Loading...

16. The IT department discovered during the last network migration that all zero phase selectors in phase 2 IPsec configurations impacted network operations.

What are two valid approaches to prevent this during future migrations? (Choose two.)

Use routing protocols to specify allowed subnets over the tunnel.

Configure an IPsec-aggregate to create redundancy between each firewall peer.

Clearly indicate to the VPN which segments will be encrypted in the phase two selectors.

Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations.

 Loading...

17. During the maintenance window, an administrator must sniff all the traffic going through a specific firewall policy, which is handled by NP6 interfaces. The output of the sniffer trace provides just a few packets.

Why is the output of sniffer trace limited?

The traffic corresponding to the firewall policy is encrypted.

auto-asic-off load is set to enable in the firewall policy,

inspection-mode is set to proxy in the firewall policy.

The option npudbg is not added in the diagnose sniff packet command.

 Loading...

 Loading...